Sublime Security medium experimental mql

Link: URL redirecting to blob URL

Detects messages containing links that redirect to blob URLs, indicating potential malware delivery or credential harvesting.

View Source

Detection Logic

type.inbound
and 0 < length(body.links) < 10
and length(recipients.to) == 1
and recipients.to[0].email.domain.valid
and any(body.links,
        // the url redirects to a blob url
        ml.link_analysis(.).effective_url.scheme =~ 'blob'
)

Field Validations

Loading…

Comments (0)

Loading comments...